GigaWiper is a modular, Golang-compiled Windows backdoor that Microsoft Threat Intelligence disclosed on July 9, 2026, tracing destructive wiping incidents back to October 2025. Unlike single-purpose wipers, GigaWiper is architected as a full command-and-control implant with 20 distinct operator commands spanning destructive, reconnaissance, and surveillance categories, delivered over a RabbitMQ message broker (AMQP, fanout exchange "All" for broadcast and topic exchange "Topic" for targeted routing-key tasking) with results and output returned via Redis as a structured cmd.Result object (error, target_ip, task_id, computer_name, output, pwd, time, status, work_status).

The malware establishes persistence by using PowerShell to register a scheduled task named "OneDrive Update" that runs at both system startup and on a one-minute interval, masquerading as legitimate OneDrive telemetry. A registry value at HKCU\SOFTWARE\OneDrive\Environment tracks execution count to prevent redundant re-initialization.

Destructive capability is delivered through three related-but-distinct code paths that Microsoft assesses were authored by the same developer(s) and stitched together into GigaWiper:

1. Command 1 (WipeMain) performs physical-disk-level destruction: it enumerates physical drives via WMI (Win32_DiskDrive), identifies which drive hosts the Windows installation, strips partition references from the remaining drives via IOCTL_DISK_CREATE_DISK (DeviceIoControl), overwrites raw disk content in 10MB (0xA00000-byte) chunks with a crypto/rand-randomized first byte followed by zero-fill, and forces an immediate, zero-delay reboot. 2. Command 12 (WipeCMain) is a reimplementation of the standalone FlockWiper C tool (first seen on VirusTotal in June 2025, PDB path A:\GRAT\CWipeNew\Release\CWipeNew.pdb) — a multi-pass secure wipe of the Windows installation drive specifically, cycling through 0x00, 0xFF, and random byte patterns with pass-timing telemetry. 3. Command 3 (RanMain / BigBangExtortMain) is fake ransomware whose function name and logic Microsoft matched to the Crucio ransomware family documented in a December 2023 CISA advisory on IRGC-affiliated actors exploiting PLCs (the same lineage publicly tied to CyberAv3ngers water/energy-sector intrusions in the US, UK, and Ireland). It generates a random AES-CBC key/IV that is never persisted anywhere, encrypts files (excluding .exe/.dll), appends a .candy extension, deletes the plaintext originals, and drops a wallpaper image (image_danger.jpg) — producing ransomware-style victim messaging with zero possibility of recovery since no key exists to recover.

Command 2 triggers a BSOD via boot-file deletion; Command 19 wipes System, Setup, Application, Security, and ForwardedEvents Windows Event Logs via `wevutil clear-log`, falling back to direct deletion of C:\Windows\System32\winevt\Logs\Security.evtx if the utility call fails — clearing forensic evidence ahead of or during destructive operations.

Beyond destruction, GigaWiper functions as a full-featured espionage/RAT platform: Command 9 captures per-monitor screenshots; Command 10 records the screen opportunistically when the session is unlocked and the user has been active for more than 10 seconds; Command 20 opens a direct TCP listener providing VNC-like live remote desktop control (screen streaming plus keyboard/mouse injection), protected by a firewall rule deceptively named after the legitimate Windows component "Microsoft.Windows.CloudExperienceHost"; Command 7 executes arbitrary PowerShell with persistent working-directory state; Command 15 collects system information (IP, CPU, OS, and installed antivirus products enumerated via `Get-WmiObject -Namespace root\SecurityCenter2`); Commands 16-18 provide full process, service, and interactive registry management; Command 5 performs bulk AES-256-CBC file encryption/decryption with attacker-supplied keys (a legitimate-use variant of the ransomware primitive); Command 4 exfiltrates files to attacker-controlled storage via a MinIO client; Command 8 manages RabbitMQ Topic-exchange routing-key bindings for individually targeted tasking; and Commands 6/11/13/14 are unused placeholder structures suggesting additional wiper/keylogger modules exist but were not recovered in analyzed samples.

Unstripped GigaWiper PE binaries allowed Microsoft to recover Golang package/function names (rabbit_tools_*, rabbit_bin, cmd_* modules) and identify the recurring debug string "GRAT" across both GigaWiper and FlockWiper artifacts, indicating a shared, still partially unidentified development framework and a probable single threat-actor lineage spanning Crucio (2023), FlockWiper (June 2025), and GigaWiper (October 2025-present).

Microsoft's public blog does not assign country attribution, but independent researcher Binary Defense tracked identical files as "BLUERABBIT" starting March 2026 and assesses an Iran-nexus actor targeting Israeli organizations, consistent with the historical CyberAv3ngers/IRGC-linked Crucio lineage against critical infrastructure. Observed C2 infrastructure: 185.182.193[.]21 (RabbitMQ on TCP/5544, Redis on TCP/7542) with 212.8.248[.]104 as apparent backup/secondary C2.

Microsoft Defender AV/EDR detects the family under Giga, Wiper, FlockWiper, and CutBrooch naming, with behavioral detections WprFlock and WprCree, and has published a Threat Analytics "Tool profile: GigaWiper" report. Recommended mitigations focus on tamper protection (blocking AV/EDR disablement and exclusion changes), disabling GPO-based local-admin AV exclusion merges, cloud-delivered protection, EDR in block mode, and attack-surface-reduction rules blocking unsigned/low-prevalence executables — alongside treating any confirmed GigaWiper intrusion as a business-continuity emergency requiring immediate isolation, backup verification, and C2 blocking before destructive commands can propagate.